ZeroTierOne/controller/DB.cpp

/*
 * Copyright (c)2019 ZeroTier, Inc.
 *
 * Use of this software is governed by the Business Source License included
 * in the LICENSE.TXT file in the project's root directory.
 *
 * Change Date: 2026-01-01
 *
 * On the date above, in accordance with the Business Source License, use
 * of this software will be governed by version 2.0 of the Apache License.
 */
/****/

#include "DB.hpp"

#include "../node/Metrics.hpp"
#include "EmbeddedNetworkController.hpp"

#include <algorithm>
#include <chrono>
#include <stdexcept>

using json = nlohmann::json;

namespace ZeroTier {

void DB::initNetwork(nlohmann::json& network)
{
	if (! network.count("private"))
		network["private"] = true;
	if (! network.count("creationTime"))
		network["creationTime"] = OSUtils::now();
	if (! network.count("name"))
		network["name"] = "";
	if (! network.count("multicastLimit"))
		network["multicastLimit"] = (uint64_t)32;
	if (! network.count("enableBroadcast"))
		network["enableBroadcast"] = true;
	if (! network.count("v4AssignMode"))
		network["v4AssignMode"] = { { "zt", false } };
	if (! network.count("v6AssignMode"))
		network["v6AssignMode"] = { { "rfc4193", false }, { "zt", false }, { "6plane", false } };
	if (! network.count("authTokens"))
		network["authTokens"] = { {} };
	if (! network.count("capabilities"))
		network["capabilities"] = nlohmann::json::array();
	if (! network.count("tags"))
		network["tags"] = nlohmann::json::array();
	if (! network.count("routes"))
		network["routes"] = nlohmann::json::array();
	if (! network.count("ipAssignmentPools"))
		network["ipAssignmentPools"] = nlohmann::json::array();
	if (! network.count("mtu"))
		network["mtu"] = ZT_DEFAULT_MTU;
	if (! network.count("remoteTraceTarget"))
		network["remoteTraceTarget"] = nlohmann::json();
	if (! network.count("removeTraceLevel"))
		network["remoteTraceLevel"] = 0;
	if (! network.count("rulesSource"))
		network["rulesSource"] = "";
	if (! network.count("rules")) {
		// If unspecified, rules are set to allow anything and behave like a flat L2 segment
		network["rules"] = { { { "not", false }, { "or", false }, { "type", "ACTION_ACCEPT" } } };
	}
	if (! network.count("dns"))
		network["dns"] = nlohmann::json::array();
	if (! network.count("ssoEnabled"))
		network["ssoEnabled"] = false;
	if (! network.count("clientId"))
		network["clientId"] = "";
	if (! network.count("authorizationEndpoint"))
		network["authorizationEndpoint"] = "";

	network["objtype"] = "network";
}

void DB::initMember(nlohmann::json& member)
{
	if (! member.count("authorized"))
		member["authorized"] = false;
	if (! member.count("ssoExempt"))
		member["ssoExempt"] = false;
	if (! member.count("ipAssignments"))
		member["ipAssignments"] = nlohmann::json::array();
	if (! member.count("activeBridge"))
		member["activeBridge"] = false;
	if (! member.count("tags"))
		member["tags"] = nlohmann::json::array();
	if (! member.count("capabilities"))
		member["capabilities"] = nlohmann::json::array();
	if (! member.count("creationTime"))
		member["creationTime"] = OSUtils::now();
	if (! member.count("noAutoAssignIps"))
		member["noAutoAssignIps"] = false;
	if (! member.count("revision"))
		member["revision"] = 0ULL;
	if (! member.count("lastDeauthorizedTime"))
		member["lastDeauthorizedTime"] = 0ULL;
	if (! member.count("lastAuthorizedTime"))
		member["lastAuthorizedTime"] = 0ULL;
	if (! member.count("lastAuthorizedCredentialType"))
		member["lastAuthorizedCredentialType"] = nlohmann::json();
	if (! member.count("lastAuthorizedCredential"))
		member["lastAuthorizedCredential"] = nlohmann::json();
	if (! member.count("authenticationExpiryTime"))
		member["authenticationExpiryTime"] = 0LL;
	if (! member.count("vMajor"))
		member["vMajor"] = -1;
	if (! member.count("vMinor"))
		member["vMinor"] = -1;
	if (! member.count("vRev"))
		member["vRev"] = -1;
	if (! member.count("vProto"))
		member["vProto"] = -1;
	if (! member.count("remoteTraceTarget"))
		member["remoteTraceTarget"] = nlohmann::json();
	if (! member.count("removeTraceLevel"))
		member["remoteTraceLevel"] = 0;
	member["objtype"] = "member";
}

void DB::cleanNetwork(nlohmann::json& network)
{
	network.erase("clock");
	network.erase("authorizedMemberCount");
	network.erase("activeMemberCount");
	network.erase("totalMemberCount");
	network.erase("lastModified");
}

void DB::cleanMember(nlohmann::json& member)
{
	member.erase("clock");
	member.erase("physicalAddr");
	member.erase("recentLog");
	member.erase("lastModified");
	member.erase("lastRequestMetaData");
	member.erase("authenticationURL");		  // computed
	member.erase("authenticationClientID");	  // computed
}

DB::DB()
{
}
DB::~DB()
{
}

bool DB::get(const uint64_t networkId, nlohmann::json& network)
{
	waitForReady();
	Metrics::db_get_network++;
	std::shared_ptr<_Network> nw;
	{
		std::shared_lock<std::shared_mutex> l(_networks_l);
		auto nwi = _networks.find(networkId);
		if (nwi == _networks.end())
			return false;
		nw = nwi->second;
	}
	{
		std::shared_lock<std::shared_mutex> l2(nw->lock);
		network = nw->config;
	}
	return true;
}

bool DB::get(const uint64_t networkId, nlohmann::json& network, const uint64_t memberId, nlohmann::json& member)
{
	waitForReady();
	Metrics::db_get_network_and_member++;
	std::shared_ptr<_Network> nw;
	{
		std::shared_lock<std::shared_mutex> l(_networks_l);
		auto nwi = _networks.find(networkId);
		if (nwi == _networks.end())
			return false;
		nw = nwi->second;
	}
	{
		std::shared_lock<std::shared_mutex> l2(nw->lock);
		network = nw->config;
		auto m = nw->members.find(memberId);
		if (m == nw->members.end())
			return false;
		member = m->second;
	}
	return true;
}

bool DB::get(const uint64_t networkId, nlohmann::json& network, const uint64_t memberId, nlohmann::json& member, NetworkSummaryInfo& info)
{
	waitForReady();
	Metrics::db_get_network_and_member_and_summary++;
	std::shared_ptr<_Network> nw;
	{
		std::shared_lock<std::shared_mutex> l(_networks_l);
		auto nwi = _networks.find(networkId);
		if (nwi == _networks.end())
			return false;
		nw = nwi->second;
	}
	{
		std::shared_lock<std::shared_mutex> l2(nw->lock);
		network = nw->config;
		_fillSummaryInfo(nw, info);
		auto m = nw->members.find(memberId);
		if (m == nw->members.end())
			return false;
		member = m->second;
	}
	return true;
}

bool DB::get(const uint64_t networkId, nlohmann::json& network, std::vector<nlohmann::json>& members)
{
	waitForReady();
	Metrics::db_get_member_list++;
	std::shared_ptr<_Network> nw;
	{
		std::shared_lock<std::shared_mutex> l(_networks_l);
		auto nwi = _networks.find(networkId);
		if (nwi == _networks.end())
			return false;
		nw = nwi->second;
	}
	{
		std::shared_lock<std::shared_mutex> l2(nw->lock);
		network = nw->config;
		for (auto m = nw->members.begin(); m != nw->members.end(); ++m) {
			members.push_back(m->second);
		}
	}
	return true;
}

void DB::networks(std::set<uint64_t>& networks)
{
	waitForReady();
	Metrics::db_get_network_list++;
	std::shared_lock<std::shared_mutex> l(_networks_l);
	for (auto n = _networks.begin(); n != _networks.end(); ++n)
		networks.insert(n->first);
}

void DB::_memberChanged(nlohmann::json& old, nlohmann::json& memberConfig, bool notifyListeners)
{
	Metrics::db_member_change++;
	uint64_t memberId = 0;
	uint64_t networkId = 0;
	bool isAuth = false;
	bool wasAuth = false;
	std::shared_ptr<_Network> nw;

	if (old.is_object()) {
		memberId = OSUtils::jsonIntHex(old["id"], 0ULL);
		networkId = OSUtils::jsonIntHex(old["nwid"], 0ULL);
		if ((memberId) && (networkId)) {
			{
				std::unique_lock<std::shared_mutex> l(_networks_l);
				auto nw2 = _networks.find(networkId);
				if (nw2 != _networks.end()) {
					nw = nw2->second;
				}
			}
			if (nw) {
				std::unique_lock<std::shared_mutex> l(nw->lock);
				if (OSUtils::jsonBool(old["activeBridge"], false)) {
					nw->activeBridgeMembers.erase(memberId);
				}
				wasAuth = OSUtils::jsonBool(old["authorized"], false);
				if (wasAuth) {
					nw->authorizedMembers.erase(memberId);
				}
				json& ips = old["ipAssignments"];
				if (ips.is_array()) {
					for (unsigned long i = 0; i < ips.size(); ++i) {
						json& ipj = ips[i];
						if (ipj.is_string()) {
							const std::string ips = ipj;
							InetAddress ipa(ips.c_str());
							ipa.setPort(0);
							nw->allocatedIps.erase(ipa);
						}
					}
				}
			}
		}
	}

	if (memberConfig.is_object()) {
		if (! nw) {
			memberId = OSUtils::jsonIntHex(memberConfig["id"], 0ULL);
			networkId = OSUtils::jsonIntHex(memberConfig["nwid"], 0ULL);
			if ((! memberId) || (! networkId))
				return;
			std::unique_lock<std::shared_mutex> l(_networks_l);
			std::shared_ptr<_Network>& nw2 = _networks[networkId];
			if (! nw2)
				nw2.reset(new _Network);
			nw = nw2;
		}

		{
			std::unique_lock<std::shared_mutex> l(nw->lock);

			nw->members[memberId] = memberConfig;

			if (OSUtils::jsonBool(memberConfig["activeBridge"], false)) {
				nw->activeBridgeMembers.insert(memberId);
			}
			isAuth = OSUtils::jsonBool(memberConfig["authorized"], false);
			if (isAuth) {
				Metrics::member_auths++;
				nw->authorizedMembers.insert(memberId);
			}
			json& ips = memberConfig["ipAssignments"];
			if (ips.is_array()) {
				for (unsigned long i = 0; i < ips.size(); ++i) {
					json& ipj = ips[i];
					if (ipj.is_string()) {
						const std::string ips = ipj;
						InetAddress ipa(ips.c_str());
						ipa.setPort(0);
						nw->allocatedIps.insert(ipa);
					}
				}
			}

			if (! isAuth) {
				const int64_t ldt = (int64_t)OSUtils::jsonInt(memberConfig["lastDeauthorizedTime"], 0ULL);
				if (ldt > nw->mostRecentDeauthTime)
					nw->mostRecentDeauthTime = ldt;
			}
		}

		if (notifyListeners) {
			std::unique_lock<std::shared_mutex> ll(_changeListeners_l);
			for (auto i = _changeListeners.begin(); i != _changeListeners.end(); ++i) {
				(*i)->onNetworkMemberUpdate(this, networkId, memberId, memberConfig);
			}
		}
	}
	else if (memberId) {
		if (nw) {
			std::unique_lock<std::shared_mutex> l(nw->lock);
			nw->members.erase(memberId);
		}
		if (networkId) {
			std::unique_lock<std::shared_mutex> l(_networks_l);
			auto er = _networkByMember.equal_range(memberId);
			for (auto i = er.first; i != er.second; ++i) {
				if (i->second == networkId) {
					_networkByMember.erase(i);
					break;
				}
			}
		}
	}

	if (notifyListeners) {
		if (networkId != 0 && memberId != 0 && old.is_object() && ! memberConfig.is_object()) {
			// member delete
			Metrics::member_count--;
		}
		else if (networkId != 0 && memberId != 0 && ! old.is_object() && memberConfig.is_object()) {
			// new member
			Metrics::member_count++;
		}

		if (! wasAuth && isAuth) {
			Metrics::member_auths++;
		}
		else if (wasAuth && ! isAuth) {
			Metrics::member_deauths++;
		}
		else {
			Metrics::member_changes++;
		}
	}

	if ((notifyListeners) && ((wasAuth) && (! isAuth) && (networkId) && (memberId))) {
		std::unique_lock<std::shared_mutex> ll(_changeListeners_l);
		for (auto i = _changeListeners.begin(); i != _changeListeners.end(); ++i) {
			(*i)->onNetworkMemberDeauthorize(this, networkId, memberId);
		}
	}
}

void DB::_networkChanged(nlohmann::json& old, nlohmann::json& networkConfig, bool notifyListeners)
{
	Metrics::db_network_change++;
	if (notifyListeners) {
		if (old.is_object() && old.contains("id") && networkConfig.is_object() && networkConfig.contains("id")) {
			Metrics::network_changes++;
		}
		else if (! old.is_object() && networkConfig.is_object() && networkConfig.contains("id")) {
			Metrics::network_count++;
		}
		else if (old.is_object() && old.contains("id") && ! networkConfig.is_object()) {
			Metrics::network_count--;
		}
	}

	if (networkConfig.is_object()) {
		const std::string ids = networkConfig["id"];
		const uint64_t networkId = Utils::hexStrToU64(ids.c_str());
		if (networkId) {
			std::shared_ptr<_Network> nw;
			{
				std::unique_lock<std::shared_mutex> l(_networks_l);
				std::shared_ptr<_Network>& nw2 = _networks[networkId];
				if (! nw2)
					nw2.reset(new _Network);
				nw = nw2;
			}
			{
				std::unique_lock<std::shared_mutex> l2(nw->lock);
				nw->config = networkConfig;
			}
			if (notifyListeners) {
				std::unique_lock<std::shared_mutex> ll(_changeListeners_l);
				for (auto i = _changeListeners.begin(); i != _changeListeners.end(); ++i) {
					(*i)->onNetworkUpdate(this, networkId, networkConfig);
				}
			}
		}
	}
	else if (old.is_object()) {
		const std::string ids = old["id"];
		const uint64_t networkId = Utils::hexStrToU64(ids.c_str());
		if (networkId) {
			try {
				// deauth all members on the network
				nlohmann::json network;
				std::vector<nlohmann::json> members;
				this->get(networkId, network, members);
				for (auto i = members.begin(); i != members.end(); ++i) {
					const std::string nodeID = (*i)["id"];
					const uint64_t memberId = Utils::hexStrToU64(nodeID.c_str());
					std::unique_lock<std::shared_mutex> ll(_changeListeners_l);
					for (auto j = _changeListeners.begin(); j != _changeListeners.end(); ++j) {
						(*j)->onNetworkMemberDeauthorize(this, networkId, memberId);
					}
				}
			}
			catch (std::exception& e) {
				std::cerr << "Error deauthorizing members on network delete: " << e.what() << std::endl;
			}

			// delete the network
			std::unique_lock<std::shared_mutex> l(_networks_l);
			_networks.erase(networkId);
		}
	}
}

void DB::_fillSummaryInfo(const std::shared_ptr<_Network>& nw, NetworkSummaryInfo& info)
{
	for (auto ab = nw->activeBridgeMembers.begin(); ab != nw->activeBridgeMembers.end(); ++ab)
		info.activeBridges.push_back(Address(*ab));
	std::sort(info.activeBridges.begin(), info.activeBridges.end());
	for (auto ip = nw->allocatedIps.begin(); ip != nw->allocatedIps.end(); ++ip)
		info.allocatedIps.push_back(*ip);
	std::sort(info.allocatedIps.begin(), info.allocatedIps.end());
	info.authorizedMemberCount = (unsigned long)nw->authorizedMembers.size();
	info.totalMemberCount = (unsigned long)nw->members.size();
	info.mostRecentDeauthTime = nw->mostRecentDeauthTime;
}

}	// namespace ZeroTier